Enterprise certificates are needed for internal apps.

And you can't have Apple knowing too much about internal apps since they could reveal trade secrets or other confidential information.

It's not a simple situation to fix.